SOGo before 5.12.7, when PostgreSQL is used, fails to properly sanitise user input in certain components of its web interface, which allows an attacker to inject arbitrary SQL statements. This flaw can enable unauthorized manipulation of database queries, potentially exposing, modifying, or destroying data stored in the PostgreSQL backend. The vulnerability is a classic example of a CWE‑89 flaw.

Alinto SOGo, any version prior to 5.12.7 that relies on PostgreSQL for data storage is affected. Unauthorized access could be achieved through the public web interface or API that interacts with the database.

The CVSS score of 7.1 indicates a high severity potential for impact. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, so the current exploit probability is uncertain. The likely attack vector is remote, via the web interface or API when PostgreSQL is the backend database, enabling an attacker to craft malicious requests that bypass normal input validation.